Drift Prevention in GitOps Workflows Using Kyverno
summary
You see a concrete workflow: Kyverno runs as an admission webhook and rejects or auto-patches requests before they hit etcd so a kubectl edit that would create drift is blocked with a clear error. Policies use plain Kubernetes YAML for validation, mutation, generation (require labels, deny privileged pods, enforce resource limits). Policies live in Git, get PR review and unit tests via the Kyverno CLI, start in audit then flip to enforce so Argo CD sync fails with Kyverno errors until fixes land in Git.
AI-written summary · about
chapters (13)
- 0:00Kyverno and GitOps drift intro
- 1:49Configuration drift in GitOps
- 3:36Drift types and detection limits
- 5:21Prevention over detection in GitOps
- 6:46Kyverno as policy engine
- 8:53Kyverno’s admission webhook
- 11:02Live edits and Kyverno
- 13:31Kyverno with Argo CD
- 13:52Policies as code in GitOps
- 14:57Policy enforcement strategy
- 15:38Kyverno as policy guarantee
- 16:22Q&A: Drift vs non-compliant changes
- 19:16Closing
related talks
25mPolicy-Based GitOps: How Policies Can Help Secure and Automate GitOps...
11mI Broke My Cluster with Kyverno (So You Don’t Have To)
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
37mKyverno Introduction And Overview
39mSolving configuration drift using GitOps and ArgoCD
29mKyverno Chronicles: A DevSecOps Tale
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
26mKeynote Session: GitOps as an Evolution of Kubernetes